From 4a81feedd04fcf9d64111ff097e1bfceedc605c2 Mon Sep 17 00:00:00 2001 From: natasha-moore-elastic Date: Fri, 2 May 2025 12:01:11 +0100 Subject: [PATCH] Add Agent version info to Endpoint data volume page --- ...configure-data-volume-for-elastic-endpoint.md | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint.md b/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint.md index 8cc6290e93..7606b931b2 100644 --- a/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint.md +++ b/solutions/security/configure-elastic-defend/configure-data-volume-for-elastic-endpoint.md @@ -24,6 +24,10 @@ Each setting has several OS-specific variants, represented by `[linux|mac|window ## Network event deduplication [network-event-deduplication] +:::{admonition} Added in 8.15.0 +This functionality was added in {{elastic-agent}} 8.15.0. +::: + When repeated network connections are detected from the same process, {{elastic-endpoint}} will not produce network events for subsequent connections. To disable or reduce deduplication of network events, use these advanced settings: `[linux|mac|windows].advanced.events.deduplicate_network_events` @@ -35,6 +39,10 @@ When repeated network connections are detected from the same process, {{elastic- ## Data in `host.*` fields [host-fields] +:::{admonition} Added in 8.18.0 +This functionality was added in {{elastic-agent}} 8.18.0. +::: + {{elastic-endpoint}} includes only a small subset of the data in the `host.*` fieldset in event documents. Full `host.*` information is still included in documents written to the `metrics-*` index pattern and in {{elastic-endpoint}} alerts. To override this behavior and include all `host.*` data for events, use this advanced setting: `[linux|mac|windows].advanced.set_extended_host_information` @@ -48,6 +56,10 @@ Users should take note of how a lack of some `host.*` information may affect the ## Merged process and network events [merged-process-network] +:::{admonition} Added in 8.18.0 +This functionality was added in {{elastic-agent}} 8.18.0. +::: + {{elastic-endpoint}} merges process `create`/`terminate` events (Windows) and `fork`/`exec`/`end` events (macOS/Linux) when possible. This means short-lived processes only generate a single event containing the details from when the process terminated. {{elastic-endpoint}} also merges network `connection/termination` events (Windows/macOS/Linux) when possible for short-lived connections. To disable this behavior, use these advanced settings: `[linux|mac|windows].advanced.events.aggregate_process` @@ -64,6 +76,10 @@ Merged events can affect the results of [event filters](../manage-elastic-defend ## MD5 and SHA-1 hashes [md5-sha1-hashes] +:::{admonition} Added in 8.18.0 +This functionality was added in {{elastic-agent}} 8.18.0. +::: + {{elastic-endpoint}} does not report MD5 and SHA-1 hashes in event data by default. These will still be reported if any [trusted applications](../manage-elastic-defend/trusted-applications.md), [blocklist entries](../manage-elastic-defend/blocklist.md), [event filters](../manage-elastic-defend/event-filters.md), or [Endpoint exceptions](../detect-and-alert/add-manage-exceptions.md#endpoint-rule-exceptions) require them. To include these hashes in all event data, use these advanced settings: `[linux|mac|windows].advanced.events.hash.md5`